Skip to content
OpenAdvisories

Package · PyPI

pgadmin4

28 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-13780 Public exploit

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the s…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.1
    CVE-2025-12762 Public exploit EPSS 13%

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the se…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.9
    CVE-2025-2945 Public exploit EPSS 56%

    pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

    Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, wher…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.9
    CVE-2024-9014 Public exploit

    OAuth2 client id and secret exposed through the web browser in pgAdmin 4

    pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • High 7.4
    CVE-2024-3116 Public exploit EPSS 66%

    Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

    pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.9
    CVE-2024-2044 Public exploit EPSS 79%

    Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

    pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execut…

    pgadmin.org pgAdmin 4 pgadmin4 PyPI